Cloudflare launches Zero Wire: public CVE cards for critical vulnerabilities
Cloudflare has launched a free public feed on Radar of critical vulnerability cards, including exploitation status and links to vendor patches.
UptimeMag editorial team · 3 November 2026 · 2 min read
Cloudflare opened today, 3 November 2026, a dedicated section within Cloudflare Radar for critical vulnerabilities affecting internet-exposed software. It's called Zero Wire and is designed for those who, each morning, receive notification of a new CVE and need to determine within ten minutes whether it affects their infrastructure and what to do about it.
What's in a card
Each card combines a plain-language explanation of the vulnerability, who needs to investigate, recommended actions, and links to proof-of-concept exploits and vendor documentation. Cloudflare makes clear this is not a catalogue of every CVE: Zero Wire integrates vendor advisories and vulnerability databases, directing readers to proof-of-concept exploits and the technical guidance needed to respond.
Cards are organised into two groups, as reported in the launch also covered by other technical publications: sorted into "Needs attention" and "Reference" categories, and it's free for everyone, not just Cloudflare customers. Being filed under "Reference" does not mean the issue is resolved everywhere: an unpatched system remains vulnerable even if the card has been archived.
Each card also provides a ready-made prompt to feed to an AI agent for read-only assessment of your own environment: which components are exposed, whether the vendor patch is already available, which mitigations are active.
The php2shell example and the WAF's role
Among the cards is one covering the PHP runtime vulnerability known as php2shell, which affects CVE-2026-109618 and CVE-2026-109619. Cloudflare's official WAF changelog shows that this emergency release updates names and metadata of seven existing rules in the Free Ruleset to detect CVE-2026-109618 and CVE-2026-109619. Coverage has extended to the free tier, but there remains a limit of 5 custom rules on the Free plan, with all actions available except Log. Cloudflare notes that a WAF rule is a stopgap: it blocks traffic in transit, but does not repair the vulnerable PHP runtime, which must be patched by the server operator.
Zero Wire is accessible from the security section of Cloudflare Radar and does not require a Cloudflare account to use.
Written with the help of artificial intelligence and checked by the editors (EU AI Act, art. 50).